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AMENDMENTS TO THE CLAIMS 



1 1 . (Currently amended) A method for rule-based network management, the method 

2 comprising the computer-implemented steps of: 

3 defining and storing a set of mies in one or more Rule-Based Markup Language 

4 ("RBML") documents, wherein the one or more RBML documents include one or 

5 more tags defining one or more rule elements, and wherein the set of rules 

6 includes: 

7 a symptom-event rule that identifies as a symptom a particular event occurring 

8 I within fee -a first networ k in a plurality of networks ; and 

9 a problem-diagnosis rule that defines a problem within the network as a 

10 conelation between one or more symptoms; 

1 1 collecting and storing symptom-related data about one or more symptoms, wherein 

12 collecting and storing the symptom-related data includes monitoring the network 

13 for one or more network events identified in the symptom-event rule; and 

14 detecting a problem within the network, wherein detecting the problem includes applying 

15 the problem-diagnosis rule to the symptom-related data; 

16 receiving a request from a user to employ a particular rule in managing a second network, 

17 separate from the first network; and 

18 distributing to a device on the second network the one or more RBML documents storing 

19 the particular rule . 

1 2. (Original) A method as recited in Claim 1, the method further comprising reviewing the 

2 set of rules to identify and resolve a conflict between two or more rules in the set. 

1 3. (Original) A method as recited in Claim 1, the method further comprising storing the one 

2 or more RBML documents in a rule repository, wherein the rule repository includes one or more 

3 directories containing RBML documents. 

1 4. (Original) A method as recited in Claim 1, wherein a RBML document storing the 

2 problem-diagnosis rule includes: 

3 a problem-definition tag describing a problem; and 
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4 a correlation tag identifying the correlation between one or more symptoms, wherein the 

5 one or more symptoms are defined in one or more symptom tags that include one 

6 or more pre-defined indicators associated with the one or more symptoms. 

1 5. (Original) A method as recited in Claim 4, wherein the step of detecting a problem within 

2 the network further comprises the steps of: 

3 comparing the symptom-related data to the one or more pre-defined indicators associated 

4 with a particular symptom to determine whether the particular symptom exists in 

5 the symptom-related data; 

6 repeating the step of comparing the symptom-related data for all symptoms identified in 

7 the correlation tag of the RBML document storing the problem-diagnosis rule; 

8 and 

9 only if all symptoms identified in the correlation tag exist, determining that the problem 
10 identified in the problem-definition tag is detected. 

1 6. (Original) A method as recited in Claim 1, wherein a RBML document storing the 

2 symptom-event rule includes: 

3 an event tag identifying the particular event occurring on the network; and 

4 a symptom tag identifying a symptom as a generalized abstraction of the particular event. 

1 7. (Original) A method as recited in Claim 6, wherein the RBML document storing the 

2 symptom-event rule further includes: 

3 a profile tag identifying a particular network device; and 

4 a command tag identifying a data-collection command, wherein the data-collection 

5 command, when executed on the particular network device, returns symptom- 

6 related data associated with the particular network device. 

1 8. (Original) A method as recited in Claim 1, wherein: 

2 the set of rules further includes a problem-correction rule defining one or more corrective 

3 actions capable of correcting the problem within the network; and 
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4 the method further comprises the step of recommending to a user one or more corrective 

5 actions defined in a RBML document storing the problem-correction rule. 

1 9. (Original) A method as recited in Claim 8, the method further comprising the step of 

2 applying to a network device, without user intervention, one or more corrective actions defined 

3 in the problem-correction rule. 

1 10. (Canceled) 

1 11. (Currently amended) A method for defining a Rule-Based Markup Language ("RBML") 

2 I to describe a set of rules for managing a first networ k among a plurality of networks , the method 

3 comprising the computer-implemented steps of: 

4 creating one or more RBML documents for storing the set of rules, wherein the one or 

5 more RBML documents include one or more tags defining one or more rule 

6 elements, and wherein: 

7 a RBML document storing a symptom-event rule from the set of rules includes: 

8 an event tag identifying a particular event occurring on the network; and 

9 a symptom tag identifying a symptom as a generalized abstraction of the 

10 particular event; and 

11 a RBML document storing a problem-diagnosis rule from the set of rules 

12 includes: 

13 a problem-definition tag describing a problem; and 

14 a correlation tag identifying a correlation between one or more symptoms, 

15 wherein the one or more symptoms are defined in one or more 

16 symptom tags that include one or more pre-defined indicators 

17 associated with the one or more symptoms; and 

18 generating, from information stored in one or more tags of the one or more RBML 

19 documents, one or more sequences of instructions, which instructions, when 

20 executed by one or more processors, cause the one or more processors to carry out 

21 the steps of: 

22 collecting and storing symptom-related data about one or more symptoms, 

23 wherein collecting and storing the symptom-related data includes 
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24 monitoring the network for one or more network events identified in the 

25 symptom-event rule; and 

26 detecting a problem within the network, wherein detecting the problem includes 

27 applying the problem-diagnosis rule to the symptom-related data; 

28 receiving a request from a user to employ a particular rule in managing a second 

29 network, separate from the first network; and 

30 distributing to a device on the second network the one or more RBML documents 

31 storing the particular rule . 

1 12. (Original) A method as recited in Claim 11, wherein the step of detecting a problem 

2 within the network further comprises the steps of: 

3 comparing the symptom-related data to the one or more pre-defined indicators associated 

4 with the one or more symptoms to determine whether a particular symptom exists 

5 in the symptom-related data; 

6 repeating the step of comparing the symptom-related data for all symptoms identified in 

7 the correlation tag of the RBML document storing the problem-diagnosis rule; 

8 and 

9 only if all symptoms identified in the correlation tag exist, determining that the problem 
10 identified in the problem-definition tag is detected. 



1 13. (Original) A method as recited in Claim 11, wherein the RBML document storing the 

2 symptom-event rule further includes: 

3 a profile tag identifying a particular network device; and 

4 a command tag identifying a data-collection command, wherein the data-collection 

5 command, when executed on the particular network device, returns symptom- 

6 related data associated with the particular network device. 

1 14. (Original) A method as recited in Claim 11, wherein: 

2 the step of creating one or more RBML documents further includes creating a RBML 

3 document for storing a problem-coiTection rule defining one or more corrective 

4 actions capable of correcting the problem within the network; and 
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instructions, which instructions, when executed by the one or more processors, 

cause the one or more processors to carry out the step of recommending to a user 

the one or more corrective actions defined in the RBML document storing the 

problem-correction rule. 

(Currently amended) An apparatus for rule-based network management, comprising: 
a rule editor for creating and storing, in one or more Rule-Based Markup Language 
("RBML") documents containing one or more tags, a set of rules employed in 
managing the- a first networ k among a plurality of networks , wherein the set of 

rules includes: 

a symptom-event mie that identifies as a symptom a particular event occurring 

within the network; and 
a problem-diagnosis rule that defines a problem within the network as a 

correlation between one or more symptoms; 
one or more processors; 

a diagnosis engine including one or more stored sequences of instructions which, when 

executed by the one or more processors, cause the one or more processors to carry 

out the steps of: 

collecting and storing symptom-related data about one or more symptoms, 
wherein collecting and storing the symptom-related data includes 
monitoring the network for one or more network events identified in the 
symptom-event rule; and 
detecting a problem within the network, wherein detecting the problem includes 
applying the problem-diagnosis rule to the symptom-related data; 
a rule broker configured to receive a request from a user to apply a particular rule in 

managing a second network, separate from the first network, and to distribute to a 
device on the second network the one or more RBML documents storing the 
particular rule- 
receiving a request from a user to employ a particular rule in managing a second 
network, separate from the first network; and 
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distributing to a device on the second network the one or more RBML documents 

storing the particular mle . 



1 16. (Original) An apparatus as recited in Claim 15, wherein the rule editor is capable of 

2 providing to a user means for reviewing the set of rules to identify and resolve a conflict between 

3 two or more rules in the set. 

1 17. (Original) An apparatus as recited in Claim 15, wherein: 

2 the problem-diagnosis rule defining the correlation between one or more symptoms 

3 includes one or more pre-defined indicators associated with the one or more 

4 symptoms; and 

5 the diagnosis engine instructions for carrying out the step of detecting a problem within 

6 the network further include instructions for carrying out the steps of: 

7 comparing the symptom-related data to the one or more pre-defined indicators 

8 associated with the one or more symptoms to determine whether a 

9 particular symptom exists in the symptom-related data; 

10 repeating the step of comparing the symptom-related data for all symptoms 

11 identified in the problem-diagnosis rule; and 

12 only if all correlated symptoms identified in the problem-diagnosis rule exist, 

13 determining that the problem defined in the problem-diagnosis rule is 

14 detected. 

1 18. (Original) An apparatus as recited in Claim 15, wherein the symptom-event rule further 

2 includes: 

3 information identifying a particular network device; and 

4 a data-collection command, wherein the data-collection command, when executed on the 

5 particular network device, returns symptom-related data associated with the 

6 particular network device. 

1 19. (Original) An apparatus as recited in Claim 15, wherein: 



7 



Ser. No. 10/714,158 filed 11/13/2003 
Sinclair et al. - 5745_CPOL 18531 1 
Docket No. 50325-0811 



2 



the set of rules further includes a problem-correction rule defining one or more corrective 
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actions capable of correcting the problem within the network; and 
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the diagnosis engine further includes instructions which, when executed by the one or 
more processors, cause the one or more processors to carry out the step of 
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recommending to a user one or more corrective actions defined in the problem- 
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correction rule. 



1 20. (Original) An apparatus as recited in Claim 19, wherein the diagnosis engine further 

2 includes instructions which, when executed by the one or more processors, cause the one or more 

3 processors to caixy out the step of applying to a network device, without user intervention, one or 

4 more corrective actions defined in the problem-correction rule. 

1 21. (Canceled) 

1 22. (Currently amended) A computer-readable storage medium carrying one or more 

2 sequences of instructions for rule-based network management, which instructions, when 

3 executed by one or more processors, cause the one or more processors to carry out the 

4 steps of: 

5 defining and storing a set of rules in one or more Rule-Based Markup Language 

6 ("RBML") documents, wherein the one or more RBML documents include one or 

7 more tags defining one or more rule elements, and wherein the set of rules 

8 includes: 

9 a symptom-event rule that identifies as a symptom a particular event occurring 

10 I within the- a first network among a plurality of networks ; and 

11 a problem-diagnosis rule that defines a problem within the network as a 

12 correlation between one or more symptoms; 

13 collecting and storing symptom-related data about one or more symptoms, wherein 

14 collecting and storing the symptom-related data includes monitoring the network 

15 for one or more network events identified in the symptom-event rule; and 

16 detecting a problem within the network, wherein detecting the problem includes applying 

17 I the problem-diagnosis rule to the symptom-related data; 
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18 receiving a request from a user to employ a particular rule in managing a second network. 

19 separate from the first network; 

20 distributing to a device on the second network the one or more RBML documents storing 

21 the particular rule . 



1 23. (Previously presented) A computer-readable storage medium as recited in Claim 22, 

2 further comprising instructions which, when executed by the one or more processors, 

3 cause the one or more processors to carry out the step of reviewing the set of rules to 

4 identify and resolve a conflict between two or more rules in the set. 

1 24. (Previously presented) A computer-readable storage medium as recited in Claim 22, 

2 further comprising instructions which, when executed by the one or more processors, 

3 cause the one or more processors to carry out the step of storing the one or more RBML 

4 documents in a rule repository, wherein the rule repository includes one or more 

5 directories containing RBML documents. 

1 25. (Previously presented) A computer-readable storage medium as recited in Claim 22, 

2 wherein a RBML document storing the problem-diagnosis rule includes: 

3 a problem-definition tag describing a problem; and 

4 a correlation tag identifying the correlation between one or more symptoms, wherein the 

5 one or more symptoms are defined in one or more symptom tags that include one 

6 or more pre-defined indicators associated with the one or more symptoms. 

1 26. (Previously presented) A computer-readable storage medium as recited in Claim 25, 

2 further comprising instructions which, when executed by the one or more processors, 

3 cause the one or more processors to carry out the steps of: 

4 comparing the symptom-related data to the one or more pre-defined indicators associated 

5 with a particular symptom to determine whether the particular symptom exists in 

6 the symptom-related data; 
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7 repeating the step of comparing the symptom-related data for all symptoms identified in 

8 the correlation tag of the RBML document storing the problem-diagnosis rule; 

9 and 

10 only if all symptoms identified in the correlation tag exist, determining that the problem 

1 1 identified in the problem-definition tag is detected. 

1 27. (Previously presented) A computer-readable storage medium as recited in Claim 22, 

2 wherein a RBML document storing the symptom-event rule includes: 

3 an event tag identifying the particular event occurring on the network; and 

4 a symptom tag identifying a symptom as a generalized abstraction of the particular event. 

1 28. (Previously presented) A computer-readable storage medium as recited in Claim 27, 

2 wherein the RBML document storing the symptom-event rule further includes: 

3 a profile tag identifying a particular network device; and 

4 a command tag identifying a data-collection command, wherein the data-collection 

5 command, when executed on the particular network device, returns symptom- 

6 related data associated with the particular network device. 

1 29. (Previously presented) A computer-readable storage medium as recited in Claim 22, 

2 wherein: 

3 the set of rules further includes a problem-correction rule defining one or more corrective 

4 actions capable of correcting the problem within the network; and 

5 the computer-readable medium further comprises instructions which, when executed by 

6 the one or more processors, cause the one or more processors to cany out the step 

7 of recommending to a user one or more corrective actions defined in a RBML 

8 document storing the problem-correction rule. 

1 30. (Previously presented) A computer-readable storage medium as recited in Claim 29, 

2 further comprising instructions which, when executed by the one or more processors, 

3 cause the one or more processors to carry out the step of applying to a network device. 
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4 without user intervention, one or more corrective actions defined in the problem- 

5 correction rule. 
1 31. (Canceled) 

1 32. (Currently amended) A computer-readable storage medium carrying one or more 

2 sequences of instructions for defining a Rule-Based Markup Language ("RBML") to 

3 I describe a set of rules for managing a first network among a plurality of networks , which 

4 instructions, when executed by one or more processors, cause the one or more processors 

5 to carry out the steps of: 

6 creating one or more RBML documents for storing the set of rules, wherein the one or 

7 more RBML documents include one or more tags defining one or more rule 

8 elements, and wherein: 

9 a RBML document storing a symptom-event rule from the set of rules includes: 

10 an event tag identifying a particular event occurring on the network; and 

11 a symptom tag identifying a symptom as a generalized abstraction of the 

12 particular event; and 

13 a RBML document storing a problem-diagnosis rule from the set of rules 

14 includes: 

15 a problem-definition tag describing a problem; and 

16 a correlation tag identifying a correlation between one or more symptoms, 

17 wherein the one or more symptoms are defined in one or more 

1 8 symptom tags that include one or more pre-defined indicators 

19 associated with the one or more symptoms; and 

20 generating, from information stored in one or more tags of the one or more RBML 

21 documents, one or more sequences of insti-uctions, which instructions, when 

22 executed by one or more processors, cause the one or more processors to carry out 

23 the steps of: 

24 collecting and storing symptom-related data about one or more symptoms, 

25 wherein collecting and storing the symptom-related data includes 

26 monitoring the network for one or more network events identified in the 

27 symptom-event rule; and 
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28 detecting a problem within the network, wherein detecting the problem includes 

29 applying the problem-diagnosis rule to the symptom-related data; 

30 receiving a request from a user to employ a particular rule in managing a second 

31 network, separate from the first network; and 

32 distributing to a device on the second network the one or more RBML documents 

33 storing the particular rule . 



1 33. (Previously presented) A computer-readable storage medium as recited in Claim 32, 

2 wherein the instructions for detecting a problem within the network further comprise 

3 instructions for carrying out the steps of: 

4 comparing the symptom- related data to the one or more pre-defined indicators associated 

5 with the one or more symptoms to determine whether a particular symptom exists 

6 in the symptom-related data; 

7 repeating the step of comparing the symptom-related data for all symptoms identified in 

8 the correlation tag of the RBML document storing the problem-diagnosis rule; 

9 and 

10 only if all symptoms identified in the correlation tag exist, determining that the problem 

1 1 identified in the problem-definition tag is detected. 



1 34. (Previously presented) A computer-readable storage medium as recited in Claim 32, 

2 wherein the RBML document storing the symptom-event rule further includes: 

3 a profile tag identifying a particular network device; and 

4 a command tag identifying a data-collection command, wherein the data-collection 

5 command, when executed on the particular network device, returns symptom- 

6 related data associated with the particular network device. 



1 35. (Previously presented) A computer-readable storage medium as recited in Claim 32, 

2 wherein: 

3 the instructions for creating one or more RBML documents further comprise instructions 

4 for carrying out the step of creating a RBML document for storing a problem- 

5 correction rule defining one or more corrective actions capable of correcting the 

6 problem within the network; and 
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7 the instractions for generating one or more sequences of instructions, by using 

8 information stored in one or more tags of one or more RBML documents, further 

9 comprise instructions for carrying out the step of recommending to a user the one 

10 or more corrective actions defined in the RBML document storing the problem- 

1 1 correction rule. 
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